Windows 11 Driver_IRQ_NOT_LESS_OR_EQUAL in dump file and Windows 11 keeps rebooting and logging DCOM 10010 and 10016 warnings and critical events.

Question

Windows 11 Driver_IRQ_NOT_LESS_OR_EQUAL in dump file and Windows 11 keeps rebooting and logging DCOM 10010 and 10016 warnings and critical events.

Rita 0

Windows 11 is randomly rebooting since I added a Thunderbolt dock to my year old Dell 9520 12th gen laptop. The system is filling up the event file with DCOM 10010 and 10016 warnings and critical errors (the 10016) before rebooting randomly throughout the day. It's becoming impossible to work.

I am current with the latest Windows 11 updates and system BIOS update. I pulled a dump file and now see there's some IRQ issue. I can't decipher what this issue is. Looks like it's a driver issue but that doesn't make sense since the drivers are supposed to be current.

This is the dump file. I've run all the diagnostics on windows files, checked the registry, hardware, etc. Everything is fine - or so all these checks tell me. Obviously something isn't working. I'd rather not have to do a reinstall of windows.

******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80086e5a5d7, address which referenced memory

Debugging Details:
------------------

*** WARNING: Check Image - Checksum mismatch - Dump: 0x32a489, File: 0x335c01 - C:\ProgramData\Dbg\sym\tcpip.sys\10FD142B32f000\tcpip.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2281

    Key  : Analysis.Elapsed.mSec
    Value: 11476

    Key  : Analysis.IO.Other.Mb
    Value: 15

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 49

    Key  : Analysis.Init.CPU.mSec
    Value: 1405

    Key  : Analysis.Init.Elapsed.mSec
    Value: 324063

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 109

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xd1

    Key  : Dump.Attributes.AsUlong
    Value: 1008

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : Failure.Bucket
    Value: AV_wanarp!WanNdisReceivePacketsCalloutRoutine

    Key  : Failure.Hash
    Value: {9593ea01-02c3-4c02-2ebe-5336da3b0a6a}


BUGCHECK_CODE:  d1

BUGCHECK_P1: 28

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80086e5a5d7

FILE_IN_CAB:  083023-16250-01.dmp

DUMP_FILE_ATTRIBUTES: 0x1008
  Kernel Generated Triage Dump

READ_ADDRESS: fffff8008151c468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 0000000000000028 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  ffffd80840711ca0 -- (.trap 0xffffd80840711ca0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc50853790c40
rdx=00000000fffffff4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80086e5a5d7 rsp=ffffd80840711e30 rbp=ffffc508261fd170
 r8=00000000fffffae8  r9=ffffc508547a6c60 r10=fffff80080a46460
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
tcpip!RawNlClientReceiveDatagrams+0xf7:
fffff800`86e5a5d7 443b4028        cmp     r8d,dword ptr [rax+28h] ds:00000000`00000028=????????
Resetting default scope

STACK_TEXT:  
ffffd808`40711b58 fffff800`80c478a9     : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd808`40711b60 fffff800`80c42f34     : 00000000`00000000 00000000`00000000 00000000`00000004 00000000`00000001 : nt!KiBugCheckDispatch+0x69
ffffd808`40711ca0 fffff800`86e5a5d7     : ffffc508`26a6f000 00000000`00000000 fffff800`870559d0 00000000`00000000 : nt!KiPageFault+0x474
ffffd808`40711e30 fffff800`86e585c6     : 00000000`00000000 ffffc508`26af0ae0 ffffd808`40711f49 ffffc508`26a6f000 : tcpip!RawNlClientReceiveDatagrams+0xf7
ffffd808`40711eb0 fffff800`86e583ed     : 00000000`00000000 ffffc508`00000101 fffff800`870559d0 00000000`00000000 : tcpip!IppProcessDeliverList+0xb6
ffffd808`40711fa0 fffff800`86e59783     : fffff800`870559d0 ffffc508`26abd8e0 ffffc508`26a6f000 ffffc508`26a6f000 : tcpip!IppReceiveHeaderBatch+0x3dd
ffffd808`40712090 fffff800`86f1f60c     : ffffc508`63bc5e20 ffffc508`53790ac0 00000000`00000001 00000000`00000000 : tcpip!IppReceivePackets+0x503
ffffd808`407121c0 fffff800`f3382939     : ffffd808`407123b0 00000000`00000000 fffff800`f3382920 ffffd808`407123d1 : tcpip!IpFlcReceivePackets+0xc
ffffd808`407121f0 fffff800`80ab354a     : 00000000`0000000e ffffc508`4d9c7e20 00000000`00000003 fffff800`f3388248 : wanarp!WanNdisReceivePacketsCalloutRoutine+0x19
ffffd808`40712220 fffff800`80ab34bd     : fffff800`f3382920 ffffd808`407123b0 ffffc508`425fa170 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x7a
ffffd808`40712290 fffff800`f3382847     : 00000000`00000001 00000400`00000000 fffff800`00000004 00000000`00001001 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffd808`407122d0 fffff800`f33815a2     : 00000000`00000006 ffffc508`43438b50 ffffd808`40712378 fffff800`f3388248 : wanarp!NetioExpandKernelStackAndCallout+0x7f
ffffd808`40712310 fffff800`86bd27c1     : 00000000`00000001 00000000`00000000 ffffd808`40712608 ffffd808`407125f0 : wanarp!WanNdisReceivePackets+0x592
ffffd808`40712430 fffff800`86bd2281     : ffffc508`53778aa0 00000000`00000001 00000000`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x141
ffffd808`40712510 fffff800`86bf6365     : ffffc508`5392d1a0 ffffc508`00000000 ffffc508`00000000 ffffc508`5392d1a0 : ndis!ndisMTopReceiveNetBufferLists+0x2f1
ffffd808`407125f0 fffff800`86bf5dd3     : 00000000`00000000 ffffd808`407126e0 fffff800`86bd1f90 00000000`00000000 : ndis!ndisCallReceiveHandler+0xb9
ffffd808`40712640 fffff800`86bf618b     : fffff800`eef631a0 ffffc508`4e738e00 fffff800`eef517f0 00000000`00000000 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f
ffffd808`40712690 fffff800`86bf5ec2     : ffffc508`5392d1a0 fffff800`86bd1f90 ffffc508`5392d1a0 00000000`00000001 : ndis!ndisIterativeDPInvokeHandlerOnTracker<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0x8b
ffffd808`40712700 fffff800`86bf642a     : ffffc508`5393bba0 00000000`00000000 00000000`00000001 ffffc508`53790ac0 : ndis!ndisInvokeIterativeDatapath<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xe2
ffffd808`40712770 fffff800`86bd3846     : 00000000`000bb95d 00000000`00000001 00000000`00000000 ffffd808`40712868 : ndis!ndisInvokeNextReceiveHandler+0xa6
ffffd808`407127d0 fffff800`ed63d02c     : ffffc508`26bd2302 ffffc508`26bd2370 ffffc508`539ec050 ffffc508`53790ac0 : ndis!NdisMIndicateReceiveNetBufferLists+0x116
ffffd808`40712860 fffff800`ed61e193     : ffffc508`66d4ab50 ffffc508`547a6de0 00000000`00000000 ffffc508`26bd2370 : ndiswan!IndicateRecvPacket+0x598
ffffd808`407128e0 fffff800`ed63d7f3     : 00000000`00000000 ffffc508`66d4ab50 00000000`00000000 ffffc508`547a6c60 : ndiswan!ApplyQoSAndIndicateRecvPacket+0x20b
ffffd808`40712940 fffff800`ed619992     : ffffc508`539ec050 ffffc508`534f3ca0 ffffc508`534f3ca0 ffffc508`66d4ab50 : ndiswan!ReceivePassThrough+0x73
ffffd808`40712970 fffff800`86c822d6     : ffffc508`536c1d00 ffffc508`54b71460 00000000`00000000 00000000`00000000 : ndiswan!ProtoCoReceiveNetBufferListChain+0x442
ffffd808`40712a10 fffff800`86bffad1     : 00000000`00000302 ffffc508`65b5a590 00000000`00000012 ffffc508`42b791d0 : ndis!ndisMCoIndicateReceiveNetBufferListsToNetBufferLists+0xf6
ffffd808`40712a70 fffff800`ed55c1db     : ffffc508`65b5a590 00000000`00000012 ffffc508`42b791d0 00000000`00000000 : ndis!NdisMCoIndicateReceiveNetBufferLists+0x11
ffffd808`40712ab0 fffff800`80a12407     : ffffc508`5385f040 ffffc508`5385f040 00000000`00000080 fffff800`ed55c010 : AgileVpn!AgileVpnProcessPackets+0x1cb
ffffd808`40712b30 fffff800`80c37194     : ffff8001`c8952180 ffffc508`5385f040 fffff800`80a123b0 00006609`93a47eb3 : nt!PspSystemThreadStartup+0x57
ffffd808`40712b80 00000000`00000000     : ffffd808`40713000 ffffd808`4070c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34


SYMBOL_NAME:  wanarp!WanNdisReceivePacketsCalloutRoutine+19

MODULE_NAME: wanarp

IMAGE_NAME:  wanarp.sys

IMAGE_VERSION:  10.0.22621.1690

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  19

FAILURE_BUCKET_ID:  AV_wanarp!WanNdisReceivePacketsCalloutRoutine

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {9593ea01-02c3-4c02-2ebe-5336da3b0a6a}

Followup:     MachineOwner

Thanks for any help you can provide deciphering this file. 
Rita

Docs 15,561 Reputation points

2023-08-31T05:45:59.58+00:00

...............

4 answers

Your answer

Docs 15,561 Reputation points

2023-08-31T05:45:59.58+00:00

...............

Answer 1

Docs 15,561

Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

https://www.elevenforum.com/t/bsod-posting-instructions.103/

.

For DCOM open a separate thread.

https://www.tenforums.com/performance-maintenance/110023-why-certain-dcom-10016-events-dont-matter.html

.

--please don't forget to upvote and Accept as answer if the reply is helpful--

.

Rita 0 Reputation points

2023-08-31T15:16:31.0766667+00:00

Hi,

Here is the link to the V2 Log file. I have not created the DCOM thread yet. I will follow up with that a bit later. Thanks again for the quick reply. I haven't gone through all the files myself yet. I did take a quick look. Just an FYI. I have been manually stopping Norton VPN from starting during the startup process. I do think there's some conflict going on with the app. Once all services start, I can manually start the system and things seem to run relatively smooth at least for a while. The system still does reboot, but it takes longer, whereas if VPN starts during startup, the system reboots within a couple of minutes every time.

Let me know if there are any issues with the link not working.

https://drive.google.com/file/d/1FNOyAUCR_FYOsOjetNtm3pLwrvGQfApx/view?usp=drive_link
Docs 15,561 Reputation points

2023-08-31T17:57:17.9433333+00:00

Please post share links that do not require sign in.
Rita 0 Reputation points

2023-08-31T21:38:49.79+00:00

Hi,

Here is the link to the V2 Log file. I have not created the DCOM thread yet. I will follow up with that a bit later. Thanks again for the quick reply. I haven't gone through all the files myself yet. I did take a quick look. Just an FYI. I have been manually stopping Norton VPN from starting during the startup process. I do think there's some conflict going on with the app. Once all services start, I can manually start the system and things seem to run relatively smooth at least for a while. The system still does reboot, but it takes longer, whereas if VPN starts during startup, the system reboots within a couple of minutes every time.

Let me know if there are any issues with the link not working.

https://drive.google.com/file/d/1FNOyAUCR_FYOsOjetNtm3pLwrvGQfApx/view?usp=drive_link
Rita 0 Reputation points

2023-08-31T21:39:47.2433333+00:00

Hi,

The link should be fixed now.

https://drive.google.com/file/d/1FNOyAUCR_FYOsOjetNtm3pLwrvGQfApx/view?usp=sharing

Thank you

Rita
Docs 15,561 Reputation points

2023-09-01T07:54:40.16+00:00

Many of the V2 files were missing.

Uninstall all of these non-Microsoft software and post a new link:

a) antivirus

b) firewall

c) drive encryption software

.

.

.

9F

D1

141

1B8

1A8
Rita 0 Reputation points

2023-09-01T13:49:09.3966667+00:00

Hello,

I am not clear on this response. I use a third-party Anti-Virus program. Are you saying I should uninstall this, set up MS's version of these apps, then rerun V2 and resend the link?

Thank you
Docs 15,561 Reputation points

2023-09-01T18:20:57.9566667+00:00

Please uninstall third party AV software so that the V2 log collector collects the applicable files for troubleshooting. Make sure that Microsoft defender is on.
Docs 15,561 Reputation points

2023-09-01T18:21:18.6666667+00:00

...............
Rita 0 Reputation points

2023-09-02T17:15:17.34+00:00

I feel like I'm going in circles in this thread. Anyway, I will not be uninstalling 3rd party VPN as Defender does not provide VPN. This is not Windows 11 home, it's Pro and used for a small business. Thanks for the suggestions, but I am trying other options.

Answer 2

Rita 0

Hello,

I appreciate the help, however I use third party VPN, something Defender does not have as an option. Looks like I will have to install Windows 11 Pro again to repair corrupt or missing files.

Thanks again.

Answer 3

Docs 15,561

The dump files and complete log files were not available.

Using only the dump file text in the opening post this crash was caused by: Agile Vpn

ffffd80840712ab0 fffff80080a12407 : ffffc5085385f040 ffffc5085385f040 0000000000000080 fffff800ed55c010 : AgileVpn!AgileVpnProcessPackets+0x1cb

.

--please don't forget to upvote and Accept as answer if the reply is helpful--

.

Answer 4

Docs 15,561

...............

Share via

Windows 11 Driver_IRQ_NOT_LESS_OR_EQUAL in dump file and Windows 11 keeps rebooting and logging DCOM 10010 and 10016 warnings and critical events.

4 answers

Your answer